Corporate Governance Advisory for Boards and Private Companies

Corporate governance advisory in California is not paperwork, and it is not a compliance exercise borrowed from public companies. It is the set of arrangements that let a board know whether management's account of the business is true, and let management act decisively without the board discovering things after the fact.

For a private company that has never needed any of it, the practical test is not whether the arrangements look impressive in a binder. It is whether a director can establish, without asking management to confirm it, that the controls they are relying on exist and are working.

What corporate governance advisory in California actually delivers

Stripped of the language, five things:

• Decision rights. Who can commit the company to what, at what value, and who must approve. Written down, matched to actual system permissions, and reviewed when people change roles.
• Board and committee structure. What the board decides versus what it oversees; whether an audit committee is warranted and what its charter says; how often it meets and what it receives beforehand.
• Information flow. What management reports, how often, at what level of detail, and (critically) how bad news reaches the board without passing through the person responsible for it.
• Risk oversight. An agreed statement of what risks the company is prepared to accept, with the ones outside that appetite escalated rather than absorbed.
• Accountability mechanisms. Whistleblowing routes, conflict-of-interest declarations, related-party transaction approval, and a process for handling an allegation involving a senior person.

Most private companies have some of this informally. The value of writing it down is not bureaucratic; it is that informal arrangements fail exactly when they are needed, which is when the person who held them in their head is the subject of the question.

Governance for companies without a formal board

Plenty of companies in Ventura County and Los Angeles County are owner-managed with a nominal board that meets once a year to sign resolutions. Governance advisory is still relevant, but the framing changes from board oversight to operating discipline.

The questions become concrete. Who can change a supplier's bank details, and does anyone verify the change by a channel other than the email that requested it. Who reviews the bank reconciliation, and is it the same person who prepares it. What happens if the founder is unreachable for three weeks. Who has administrative access to the accounting system, and when was that list last examined.

These sound operational because they are. They are also, in aggregate, the governance framework of a company that does not think it has one, and each of them corresponds to a loss that a comparable company somewhere has already suffered.

Audit committee support

Audit committees in mid-market companies are frequently composed of directors with real commercial experience and no assurance background. They are asked to evaluate the external auditor, form a view on management's judgments, oversee the internal control environment, and respond to whistleblower reports, without a technical adviser of their own.

Support here typically covers charter drafting, an annual work plan mapped to the reporting calendar, preparation for the auditor's required communications and what the committee should probe in them, independent review of significant accounting judgments, and briefing on matters where the committee's obligations differ from management's.

Having spent twenty years on the auditor's side of that table informs what is actually useful: the questions that reliably surface a problem, and the answers that sound reassuring but are not.

Technology and AI on the board agenda

Boards are increasingly expected to oversee cybersecurity and, now, AI adoption, usually without anyone in the room who can evaluate what they are being told. The result is a briefing that either alarms without informing or reassures without evidence.

Practical oversight is narrower than the topic suggests. For cybersecurity: what would a material incident actually cost this company, which third parties hold our data, what is the actual recovery time rather than the target, and when was that last tested. For AI: where is it in use, what data goes into it, who validated the output before it was relied upon, and what is the position if a customer asks whether their data trained a model.

Because this practice also performs the underlying cybersecurity risk assessment work, the board briefing is grounded in what the assessment found rather than in generic risk language.

The independence boundary

Governance advisory and assurance cannot be performed by the same party on the same subject matter. An advisor who designs a control framework cannot then provide an objective opinion on whether it works, and any firm offering both on the same engagement is offering you a compromised outcome.

Both services exist here, and the boundary is agreed in writing at the start. Where this practice designs, the testing goes elsewhere. Where this practice tests (see internal controls assessment) the design work belongs to management or another advisor.